fix: harden GitHub Actions workflows

[fzipi]

what

• pin actions/checkout and actions/setup-python to commit SHAs instead of mutable v2 tags
• add explicit permissions: contents: read to all workflows

why

• unpinned actions reference mutable tags that can be moved by upstream maintainers or attackers
• publish.yml handles PyPI credentials (TWINE_USERNAME/PASSWORD) and was using unpinned actions — a supply chain attack could exfiltrate secrets
• explicit permissions follow the principle of least privilege

refs

• GitHub docs: security hardening for GitHub Actions